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Abstract 


In  this  paper  we  develop  a  general  purpose  algorithm  that  can  solve 
a  number  of  NP-complete  problems  In  time  T*0(2nyf2)  and  space  S*0(2n//4). 
The  algorithm  can  be  generalized  to  a  family  of  algorithms  whose  time 
and  space  complexities  are  related  by  T*S2  =  0(2n).  The  problems  it  can 
handle  are  characterized  by  a  few  decomposition  axioms,  and  they  include 
knapsack  problems,  exact  satisfiability  problems,  set  covering  problems, 
etc.  The  new  algorithm  has  a  considerable  cryptanalytic  significance, 
since  it  can  break  knapsack- based  cryptosystems  with  up  to  n  *  100 
generators. 

Key  words  and  phrases:  NP-complete  problems,  time/space  tradeoffs, 
knapsack  problems,  Merkle-Hellman  cryptosystems. 
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1-  Introduction 

Every  NP-complete  problem  can  be  solved  in  0(2n)*  time  by  exhaustive 
search,  but  this  complexity  becomes  prohibitive  when  n  exceeds  40  or  50. 
Assuming  that  NP  t  P,  we  cannot  hope  to  find  algorithms  whose  worst-case 
complexity  is  polynomial,  but  it  is  both  theoretically  interesting  and 
practically  important  to  determine  whether  substantially  faster  algorithms 
exist.  Researchers  have  so  far  discovered  a  few  special-purpose 
algorithms  (most  notably  a  T  =  S  =  0(2n^2)  algorithm  for  knapsacks  by 
Horowitz  and  Sahni  [1974]  and  a  T  =  0(2n/3),  S  «  0(n)  algorithm  for  cliques 
by  Tarjan  and  Trojanowski  [1977]),  but  no  comprehensive  theory  of  such 
subexponential  algorithms  has  been  developed.  In  this  paper  we  describe 
a  general-purpose  algorithm  which  can  solve  a  fair  number  of  NP-complete 
problems  (including  knapsack,  partition,  exact  satisfiability,  set 
covering,  hitting  set,  disjoint  domination  in  graphs,  etc.)  in  time  and 

2  p 

space  complexities  which  are  related  by  the  tradeoff  curve  T*S  =  0(2  ) 
for  0(2n^2)  <  T  <  0(2n).  The  novel  properties  of  this  algorithm  are: 

(i)  The  time/space  complexities  of  the  algorithm  are  considerably  better 
than  those  of  all  the  algorithms  published  so  far  for  these 
problems.  Furthermore,  the  algorithm  is  completely  practical  in 
the  sense  that  it  is  easy  to  program  and  its  overhead  is  small, 
and  thus  it  can  handle  problems  which  are  almost  twice  as  big  as 
those  handled  by  previous  algorithms. 


^Throughout  this  paper,  we  ignore  polynomial  multiplicative  factors  in 
the  0-notation  of  exponential  functions.  These  factors  are  usually  of 
degree  0  or  1 ,  and  their  practical  effect  is  very  small. 
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(ii)  The  algorithm  demonstrates  an  interesting  tradeoff  between  time 
and  space  -  in  order  to  decrease  time  by  a  factor  c,  it  is  enough 
to  increase  space  by  a  factor  of  s«jrt(c).  Since  space  is  much 
more  expensive  than  time,  this  tradeoff  has  a  very  favorable 
economics. 

(ill)  The  problems  to  which  the  algorithm  can  be  applied  are  characterized 
axlomatically  by  their  behavior  under  composition.  This  approach 
introduces  a  natural  subclassification  of  NP-complete  problems  and 
indicates  how  a  problem- independent  theory  of  subexponential 
algorithms  may  be  constructed. 

One  of  the  most  important  applications  of  the  new  algorithm  is  in 

cryptanalysis,  since  many  of  the  newer  public-key  cryptosystems  are  based 

on  large  NP-complete  problems  (Diffie  and  Heilman  [1976]).  With  current 

technology,  the  practical  limit  on  the  number  of  operations  a  cryptanalyst 

can  perform  is  between  250  and  260  (a  parallel  computer  with  1000  processors 

50 

whose  cycle  time  is  one  microsecond  performs  2  operations  in  about  two 
weeks),  and  the  practical  limit  on  the  number  of  memory  cells  he  can  use 
is  between  22^  and  23^.  By  choosing  the  point  T  0(2n^)  and  S  *  0( ) 
on  the  time/space  tradeoff  curve,  instances  with  up  to  n  ■  100  are  within 
reach,  and  thus  the  new  algorithm  can  break  all  the  knapsack-based 
cryptosystems  recommended  so  far  in  the  literature  (e.g.,  Merkle  and 
Heilman  [1978]).  This  cryptanalytlc  attack  can  be  foiled  by  increasing  the 
minimum  recommended  size  from  n*100  to  n *  200  (at  the  expense  of  tripling 
the  key  size  and  the  encryption  time),  but  It  is  a  clear  warning  against 
overconfidence  and  narrow  safety  margins  in  public-key  cryptosystems. 
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The  problems  our  algorithm  can  handle  are  described  In  Section  2. 

A  T  =  0(2n^2)  S  =  CH2n/^)  algorithm  is  presented  in  Section  3.  In 
Section  4  we  generalize  this  algorithm  to  a  family  of  algorithms 
whose  time  and  space  complexities  are  related  by  the  T-S2  =  0(2n) 
tradeoff  curve. 

2.  A  Calculus  of  Problems 

To  make  our  basic  algorithm  as  versatile  as  possible  and  to  expose 
the  minimum  conditions  that  guarantee  its  correctness,  we  define  the  notion 
of  a  problem  in  a  fairly  abstract  way: 

Definition:  A  problem  of  size  n  is  a  predicate  P  over  n-bit  binary  strings. 
A  string  x  is  a  solution  (or  a  witness)  of  the  problem  if  P(x)  is  true. 

The  goal  is  to  find  one  such  x,  if  it  exists. 

Example:  The  predicate  of  the  knapsack  problem  "is  there  a  bit  string 
x^x^Xj.  such  that  x^ *7  +  x^'S  +  x^*9+ x^*6  +  x^*2  =  11?"  is  oi  size  5,  and 
its  solutions  are  01011  and  00101.  I~/ 

Remark:  The  size  |P|  of  a  problem  P  is  defined  as  the  number  of  bits  in 
its  solution  rather  than  the  number  of  bits  in  its  description,  since  the 
0(2n)  complexity  of  exhaustive  search  (upon  which  we  want  to  improve)  is 
determined  primarily  by  the  size  of  the  solution  space.  However,  to  make 
our  results  strictly  correct  we  have  to  assume  that  these  two  measures  are 
polynomially  related,  i.e.,  that  we  are  not  given  huge  descriptions  of 
problems  with  very  few  bits  of  unknowns. 
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One  of  the  most  useful  algorithmic  techniques  for  solving  problems 
is  divide-and-conquer .  Given  a  problem  P,  we  decompose  it  into  a  number 
of  subproblems  (usually  two  of  half  size  each),  solve  them  separately, 
and  then  combine  their  solutions.  To  simplify  the  mathematical  analysis 
of  this  process,  we  introduce  the  following  operator: 

Definition:  A  binary  operator  a  on  problems  is  a  composition  operator  if 

(i)  it  is  additive:  for  all  P'  and  P",  |P'®P"|  =  |P‘|  +  )P"|; 

(ii)  it  is  sound :  for  any  two  solutions  x'  of  P*  and  x"  of  P“,  the  string 
concatenation*  x'x"  is  a  solution  of  P'®P"; 

(iii)  it  is  complete:  for  any  solution  x  of  P  and  for  any  representation 
of  x  as  x  =  x'x",  there  are  problems  P'  and  P"  such  that  x’  solves 
P’,  x"  solves  P",  and  P*P'«P"; 

(iv)  it  is  polynomial :  the  problem  P'«P"  can  be  calculated  In  time  which 
is  polynomial  in  the  sizes  of  P'  and  P". 

Intuitively,  ®  is  sound  if  any  two  solutions  of  the  subproblems  P' 
and  P"  can  be  easily  conbined  in  order  to  get  a  solution  for  the  original 
problem  P,  and  complete  if  any  solution  of  P  can  be  obtained  in  such  a 
way: 

{xJP(x)>  =  U  {x'x" | P’ (x* )  and  P"(x")}  . 

P'®P"=P 

A  pair  of  problems  P',Pn  is  said  to  be  a  decomposition  of  P  if  P'®P"3P, 
and  in  general  a  problem  can  have  many  possible  decompositions.  To  solve 

P,  we  can  try  out  all  its  possible  P',P"  decompositions  until  we  find  a 
* 

The  string  concatenation  can  be  replaced  by  any  other  simple  operation 
which  is  length-additive. 
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pair  of  solvable  subproblems.  If  P  is  solvable  and  ®  is  complete,  these 
subproblems  must  exist,  while  if  P  is  unsolvable  and  ©  is  sound,  these 
subproblems  cannot  exist  (otherwise  their  concatenated  solutions  would 
have  solved  P).  There  are  many  NP-complete  problems  for  which  composition 
operators  exist,  and  the  following  examples  are  typical: 

Example:  Let  (b,a^,...ta  )  be  the  knapsack  problem  in  which  the  target 
value  b  is  to  be  represented  as  a  sum  of  a  subset  of  the  generators  a^ 

For  any  two  problems  P'  =  (b‘ ,aj , . . . ,a^)  and  P"  =  (b",aV,. . . ,a^)  we  define 
P'©P"  =  (b'+b" ,aj . . ,a^,a|,. . . ,a^)  (i.e.,  we  add  the  b's  and  concatenate 
the  a^'s).  We  claim  that  this  ©  is  a  composition  operator: 

(i)  ©  is  additive  since  the  number  of  generators  in  P'©P"  is  by  definition 

the  sum  of  the  corresponding  numbers  in  P'  and  P". 

£  m  t+m 

(ii)  ©  is  sound  since  x!a'.  =  b'  and  Z  x'.'aV  =  b"  imply  that  Z  x.a.  = 

i=i  ii  i =1  ii  i=l  1  1 

b'+b"  (where  the  x..  are  the  bits  of  x'x"  and  the  a.  are  the  generators 
in  P'®P"). 

(iii)  ©  is  complete  since  for  each  x  =  x'x"  such  that  |x'|  =  £,  |x"|  =  m, 

8,+m 

and  z  x1-ai  =  b,  there  are  b'  and  b"  such  that  x'  satisfies 
l  1=1  n+m 

. Z  xla.  =  b',  x"  satisfies  Z  x'.'a,  =  b",  and  the  sum  of  these  two 

i=l  1  i  i=£+l  i  1 

subproblems  is  the  original  problem  (b,a^ ,. . . ,afc+m). 

(iv)  ©  is  polynomial  since  the  only  operations  involved  are  numeric  additior 
and  list  concatenation.  /“/ 

Example:  Let  F  be  a  formula  in  CNF  (i.e.,  a  conjunction  of  clauses  which 
are  disjunctions  of  literals  which  are  variables  x^  or  their  negations  x^). 
The  satisfiability  problem  is  to  find  a  truth-value  assignment  to  the 
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variables  which  makes  at  least  one  literal  in  each  clause  true.  To 
decompose  this  problem,  we  can  partition  the  list  of  variables  into  two 
complementary  sublists,  and  try  to  satisfy  by  the  two  partial  assignments 
two  sets  of  clauses  whose  union  contains  all  the  clauses.  In  this 
generalized  formulation,  each  subproblem  corresponds  to  a  sublist  of 
variables  and  a  subset  of  clauses  in  F,  and  the  ®  operator  concatenates 
the  sublists  (if  they  are  consecutive)  and  unions  the  subsets  in  P1  and 
P".  This  operator  is  clearly  additive  and  polynomial.  It  is  sound  since 
by  definition  P'®P"  is  satisfied  by  the  concatenation  of  any  pair  of 
assignments  that  satisfy  P'  and  P",  and  it  is  complete  since  for  any  x 
that  solves  P  we  can  use  the  clauses  which  are  actually  satisfied  by  the 
prefix  and  suffix  of  x  in  order  to  define  the  appropriate  P'.P" 
decomposition.  /“/ 

The  relationship  between  problems  (especially  NP-complete  problems) 
and  their  solutions  is  often  asymmetric,  since  it  may  be  much  harder  to 
find  a  solution  for  a  given  problem  than  to  find  a  problem  which  is  solved 
by  a  given  solution.  This  motivates  the  following  definition: 

Definition:  A  set  of  problems  is  polynomially  enumerable  if  there  is  a 
polynomial  time  algorithm  which  finds  for  each  bit  string  x  the  subset 
of  problems  which  are  solved  by  x. 

Example:  (1)  The  set  of  all  the  knapsack  problems  is  not  polynomially 
enumerable  since  for  each  x  there  are  infinitely  many  knapsack 
problems  which  are  solved  by  x. 

(11)  The  set  of  knapsack  prlblems  with  a  fixed  set  of  a,,  generators  (but 
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varying  target  values  b)  is  polynomially  enumerable,  since  for  each 

n 

x  there  is  exactly  one  b  such  that  b  =  E  x.a.,  and  this  b  can  be 

i  =  1  1  • 

easily  calculated. 

(iii)  The  set  of  (generalized)  satisfiability  problems  with  a  fixed  formula 
F  is  polynomially  enumerable,  since  the  subset  of  clauses  which  are 
satisfied  by  the  truth-value  assignment  x  is  uniquely  defined  and 
can  be  found  by  simple  evaluation.  /”/ 

If  a  set  of  problems  is  polynomially  enumerable,  then  all  its  solvable 
instances  of  size  n  can  be  tabulated  (as  problem/solution  pairs)  in  0(2n) 
time  and  space.  Again,  there  are  many  NP-complete  problems  whose  sets  of 
subproblems  are  polynomially  enumerable,  and  they  have  the  curious  property 
that  it  is  almost  as  difficult  to  solve  a  single  instance  of  size  n  as  it 
is  to  solve  all  the  instances  of  size  n  -  in  both  cases  we  have  to 
enumerate  all  the  possible  n-bit  solutions. 

The  most  restrictive  and  least  intuitive  condition  we  impose  on 
problems  is: 

Definition:  A  composition  operator  ©  is  monotonic  if  the  problems  of  each 
size  can  be  totally  ordered  in  such  a  way  that  ©  behaves  monotonicall> : 

I P ’  |  =  | P" |  and  P'<P"  imply  that  P'©P<P"©P  and  P©P'<P©P". 

Using  this  notion,  we  can  state  the  main  result  of  this  paper  (which 
is  proved  in  the  next  section): 

Theorem  1 :  If  a  set  of  problems  is  polynomially  enumerable  and  has  a 
monotonic  composition  operator,  then  its  instances  of  size  n  can  be  solved 
in  time  T  =  0(2n^)  and  space  S  =  0(2n^). 


Example:  The  ®  operator  on  knapsack  problems  is  monotonic  if  we  order 
them  lexicographically,  since  (b',aj,...,ap  <  (b"taj',...  ,ap  implies  that 
(b  +b,aj ....  .a^.a^ .  ,a^)  <  ( b  ^b ,a-j , . . .  ,  a^  ,a ^ . . ,3^)  end 
(b+b',a1,...,am,aj,...,aJp<  (b+b",a1,...,am,aj,,...,a£).  (Note  that  this 
®  operator  is  not  monotonic  if  P'  and  P"  are  allowed  to  be  of  different 
sizes).  Consequently,  our  algorithm  can  solve  knapsack  problems.  /”/ 

Composition  operators  based  on  set  unions  are  usually  non-monotonic, 
but  they  become  monotonic  if  we  replace  the  set  unions  by  multiset  unions: 

Lemma  2:  (i)  If  |S|  ^3,  then  the  subsets  of  S  cannot  be  totally  ordered 
in  a  way  that  makes  the  set  union  operator  monotonic. 

( i i )  If  S  is  denumerable,  then  the  multi  subsets  of  S  with  finite  multipli¬ 
cities  can  be  totally  ordered  in  a  way  that  makes  the  multiset  union 
operator  monotonic. 

Proof:  (i)  Suppose  that  such  an  order  exists.  Without  loss  of  generality, 
we  can  assume  that  for  a,b,c  e  S,  {a}  <  {b} <  {c}.  By  taking  the  set 
unions  of  these  singletons  with  {a,c}  and  by  using  the  monotonicity 
of  U,  we  get 

(a) U  (a,c)  <  (b) U  {a,c} <  (c } U  {a,c}  ; 
this  evaluates  to 

(a.c) <  {a,b,c} <  {a,c} 
which  is  a  contradiction. 

(ii)  Let  S  be  {a^,a2,...}.  The  multisubsets  of  S  with  finite  null  tipi icities 
can  be  represented  by  semi-infinite  vectors  of  multiplicities  (n^,n2,...) 
in  which  each  n.,  represents  the  number  of  occurrences  of  a^.  In  this 


-9- 


representation,  multiset  union  Is  simply  a  componentwise  addition 
of  multiplicity  vectors,  and  It  is  clearly  a  monotonic  operator  if 
we  order  the  vectors  lexicographically.  Q.E.D. 

Example;  By  part  (1)  of  the  lemma,  the  (generalized)  satisfiability 
problems  cannot  be  totally  ordered  in  a  way  that  makes  the  ®  operator 
monotonic,  and  thus  our  algorithm  cannot  be  used  in  order  to  solve  them.  /  / 

Example:  The  exact  satisfiability  problem  is  similar  to  the  satisfiability 
problem,  except  that  we  want  to  satisfy  exactly  one  literal  in  each  clause. 
Its  subproblems  consist  of  sublists  of  variables  and  multisets  of  clauses, 
and  the  multiplicity  of  each  clause  indicates  how  many  literals  are 
satisfied  in  it  (e.g.,  the  original  problem  corresponds  to  the  multiset 
(1 ,1 ,. . . ,1 ,0,0,. . . )).  By  part  (ii)  of  the  lemma,  the  ®  composition  operator 
that  concatenates  the  sublists  and  adds  the  multiplicities  is  monotonic,  and 
thus  we  can  apply  our  algorithm  to  this  variant  of  the  satisfiability 
problem.  /  / 

We  leave  it  as  an  exercise  for  the  reader  to  verify  that  all  the  NP- 
complete  problems  listed  in  the  introduction  have  monotonic  composition 
operators.  This  list  is  not  exhaustive,  and  it  is  easy  to  come  up  with 
additional  examples. 

3.  The  Algorithm 

The  algorithm  uses  the  soundness  and  completeness  of  ®  in  order  to 
reduce  the  general  problem  to  the  following  combinatorial  search  problem: 

Definition:  Given  k  problem/solution  tables  T^  with  0(2n/^)  solvable 
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problems  each,  a  monotonic  composition  operator  and  a  problem  I*,  the 
k-table  problem  Is  to  determine  whether  there  are  k  representatives 
PjeTj  such  that  P  *  P19P2®...«P)(  (under  a  given  parentheslzatlon). 

Example:  To  reduce  a  given  knapsack  problem  P  with  n  =  3m  generators  a^ 
to  the  3-table  problem,  we 

(1)  divide  the  generators  Into  three  sublists  ),  ^am+l ’ ' ’ ' *a2m^ 

and  ^a2m+l ***  * ,a3m^ ’ 

(ii)  tabulate  In  (1»  1,2,3)  all  the  0(2n^)  target  values  b.  which  can 
be  generated  by  sunning  a  subset  of  the  n/3  generators  In  the  1-th 
third  of  the  problem; 

(111)  check  whether  the  original  target  value  b  can  be  represented  as 
b  *  b1  +  b2  +  b3  for  some  bj  e  ,  b^eT^  b3  e  T3 ; 

(1v)  concatenate  the  three  solutions  x{  tabulated  for  these  target 

values  (If  they  exist)  In  order  to  get  a  solution  x  *  x^x-j  for  the 
original  problem.  f~f 

Example:  To  reduce  an  exact  satisfiability  problem  to  the  4-table  problem, 
we  divide  the  variable  list  into  four  quarters,  enumerate  for  each  quarter 
all  the  0(2n/^)  possible  truth-value  assignments,  tabulate  for  each 
assignment  the  multiset  of  satisfied  clauses,  and  determine  whether  there 
are  four  multiplicity  vectors  In  the  four  tables  whose  sum  Is 
(1,1 . 1,0,0,...).  II 

This  general  technique  is  a  mixture  of  divide-and-conquer  and  dynamic 
programming  -  we  repeatedly  divide  problems  Into  pairs  of  subproblems 
until  we  get  k  problems  of  size  n/k  each,  and  then  finish  by  searching  k 
problem/solutlon  tables.  Since  we  do  not  assume  that  ®  is  associative,  we 
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have  to  fully  parenthesize  the  P^P^. .  .®Pk  sum  to  make  it  meaningful,  but 
the  completeness  of  9  implies  that  the  solvability  of  this  k-table  problem 
does  not  depend  on  the  parenthesis  structure  (i.e.,  we  can  choose  the 
order  that  makes  the  search  most  efficient). 

The  obvious  algorithm  for  the  k-table  problem  is  to  try  out  all  the 
0(2n)  combinations  of  representatives  from  the  k  tables,  and  it  is  clearly 
optimal  for  k  =  1.  However,  for  k  >  2,  better  algorithms  exist: 

Theorem  3:  The  2-table  problem  can  be  solved  in  0(2n^)  time  and  space. 

Proof:  Consider  the  following  algorithm: 

(1)  Sort  Tj  into  increasing  problem  order; 
sort  T^  into  decreasing  problem  order. 

(2)  Repeat  until  either  T^  or  T^  become  empty  (in  which  case  print 
"unsolvable"  and  halt): 

S  ♦  first  (Tj)  9  first  (T^); 
if  S  =  P  print  "solvable"  and  halt; 
if  S  <  P  delete  first  (T^)  from  ; 
if  S  >  P  delete  first  (I2)  from  T,,. 


To  prove  the  correctness  of  this  algorithm,  we  have  to  show  that 
whenever  a  problem  is  deleted  from  T^  or  T2,  it  cannot  possibly  participate 
in  any  sum  which  equals  P  (and  thus  the  deletion  cannot  affect  the  correct¬ 
ness  of  the  rest  of  the  algorithm).  Since  T2  is  decreasing  and  9  is  monotonic, 
first  (Tj)  9  P2  <  first  (Tj)  9  first  (T2)  for  any  P,,t  T2.  Consequently, 
the  left-hand  side  cannot  be  equal  to  P  if  the  right  hand  side  is  smaller 
than  P,  and  the  deletion  of  first  (T^)  from  T^  is  justified.  Similarly, 


Pj  9  first  (T^ )  first  (Tj)  •  first  (1.,)  i>  P  justifies  the  deletion  of 
first  ( Tg )  from  T2< 

The  time  complexity  of  the  sorting  step  is  0(2n^2(n/2))  ■  0(2n^2), 
and  the  time  complexity  of  the  search  step  is  0(|T^|  +  |T2|)  ■  0( 2n/^2) 
since  we  delete  at  least  one  element  at  each  iteration.  Q.E.D. 

Remark:  This  2-table  problem  has  been  posed  and  solved  in  a  number  of 
papers  under  various  disguises  (e.g.,  Knuth  [1973,  page  9],  Horowitz  and 
Sahni  [1974]).  In  the  rest  of  this  paper  we  refer  to  this  algorithm  as 
the  basic  algorithm. 

The  basic  algorithm  can  be  easily  extended  to  other  values  of  k: 

Lemma  4:  The  3-table  problem  can  be  solved  In  0(22n^3)  time  and  0(2n^3) 
space. 

Proof:  For  each  one  of  the  0(2n^3)  problems  P^ e  Tj,  use  the  basic  algorithm 
on  the  T2,T3  tab1es  *n  order  to  find  a  solution  for  P»P1®(P2«P3)  In  time 
0(|T1|)  -  0(2n/3).  Q.E.D. 

Ljemn?a_5:  The  4-table  problem  with  a  non-balanced  parenthesis  structure 
P  =  Pj«(P2*(P3«P4))  can  be  solved  In  0(23n^)  time  and  0(2n^)  space. 

Proof:  For  each  one  of  the  0(2n^)  problems  Pj  t  Tj ,  solve  the  remaining 
3-table  problem  in  0(|T^|2)  -  Q(2n^2)  time*  Q.E.D. 


All  the  time  and  space  complexities  considered  so  far  satisfy  the 
invariant  relation  T’S  *  0(2n),  and  thus  Improvements  in  the  space  complexity 
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make  the  time  complexity  worse  by  a  similar  factor.  This  trend  Is  broken 
by  the  unexpected  behavior  of  the  following  case: 

Theorem  6:  The  4-table  problem  with  balanced  parenthesis  structure 
P  =  ( )©( P^©P^ )  can  be  solved  in  O^11^2)  time  and  0(2n^)  space. 

A  direct  application  of  the  basic  algorithm  to  the  two  0(2n^2) 
supertables  generated  by  the  (Pj©P2)  and  (P^ftP^)  combinations  leads  to  a 
T  =  S  =  0( 2n/^2 )  algorithm.  However,  the  basic  algorithm  accesses  the 
elements  of  the  sorted  supertables  sequentially,  and  thus  there  is  no  need 
to  store  all  the  possible  combinations  simultaneously  in  memory  -  all  we 
need  is  the  ability  to  generate  them  quickly  (on-line,  upon  request)  in 
sorted  order.  To  implement  this  key  idea,  we  use  two  priority  queues: 

(i)  Q'  stores  pairs  of  problems  from  T^  and  T2,  enables  arbitrary 

insertions  and  deletions  to  be  done  in  logarithmic  time,  and  makes 
the  pair  with  the  smallest  P^®P2  sum  accessible  in  constant  time, 
(ii)  Q"  stores  pairs  of  problems  from  T^  and  T^,  enables  arbitrary 

insertions  and  deletions  to  be  done  in  logarithmic  time,  and  makes 
the  pairs  with  the  largest  P-^P^  sum  accessible  in  constant  time. 
Efficient  heap  implementations  of  priority  queues  are  described  in  Aho, 
Hopcroft,  Ullman  [1974]. 

The  balanced  4-table  algorithm 

(1)  Sort  T2  into  increasing  problem  order; 
sort  T^  into  decreasing  problem  order; 

Insert  into  Q'  all  the  pairs  (Pj,  first  (T2))  for  P^cT^; 
insert  into  ()"  all  the  pairs  (P{,  first  (T^))  for  P^  ■  T}. 


L 


i 


-14- 


(2)  Repeat  until  either  Q'  or  Q"  become  empty  (In  which  case  print 
"unsolvable"  and  halt): 

(PrP2>  *  smallest  sum  *n  Q'» 

( p3 •  p4 )  •*-  pair  with  largest  P3®P4  sum  In  Q"; 
s  -  (p1®p2)«(p3«p4) 

If  S  =  P  print  "solvable"  and  stop; 

If  S  v  P  do 

delete  (P],P2)  from  Q'; 
if  the  successor  P£  of  P2  in  T,,  Is  defined, 
insert  (P^ .P^)  into  Q' ; 

if  S  >  P  do 

delete  (P3.P4)  from  Q"; 

If  the  successor  PJ  of  P^  In  Is  defined. 

Insert  (P3.P4)  Into  Q\ 

Lemma  7:  The  space  complexity  of  this  algorithm  is  0(2n/^). 

Proof:  It  is  easy  to  show  by  Induction  that  at  each  stage  a  Pj  e  Tj  can 
participate  in  at  most  one  pair  in  Q',  and  a  P3f  T3  can  participate  in  at 
most  one  pair  In  Q"  (the  number  of  occurrences  of  PgcTg  and  P4tTj  in  Q' 
and  Q"  can  be  higher).  The  space  complexity  of  the  priority  queues  is 
thus  bounded  by  0(|T^|)  =  0(2n^4).  Q.E.D. 

Lemma  8:  The  time  complexity  of  this  algorithm  is  0(2n^2). 

Proof:  Each  (Pj.Pg)  pair  can  be  deleted  from  Q'  at  most  once,  since  It  Is 
never  reinserted  Into  Q*.  Similarly,  each  ( * p4 )  P*lr  can  be  deleted 


1 


from  Q"  at  most  once.  At  each  Iteration  of  step  2,  one  pair  is  deleted 
from  Q'  or  Q",  and  thus  the  number  of  iterations  cannot  exceed  the  number 
of  possible  pairs,  which  Is  0(2n^).  Q.E.D. 

Lemma  9;  Q‘  can  become  empty  only  after  we  consider  all  the  possible  (Pj.P^) 
pairs  of  problems  from  Tj.T,,  (similarly  for  Q"  and  T3,T4). 

Proof :  Initially  P^  shares  a  pair  In  Q*  with  the  first  element  of  T^.  After 
each  deletion  of  a  (P.j,P2)  pair  we  reinsert  P^  together  with  the  next  larger 
element  of  T2,  and  thus  the  only  way  Q'  can  become  empty  is  if  each  Pj 
runs  out  of  companions  after  a  complete  first-to-last  scan  of  T2>  Q.E.D. 

Lemma  10:  The  sums  of  the  pairs  extracted  from  Q'  are  in  non-decreasing 
sorted  order,  and  the  sums  of  the  pairs  extracted  from  Q"  are  in  non¬ 
increasing  sorted  order. 

Proof:  The  smallest  (Pj.Pg)  pair  in  Q'  is  replaced  by  a  (P^P^)  pair  whose 
sum  is  larger  (since  T?  is  sorted  and  ®  is  monotonic),  and  thus  the  sum 
of  the  next  pair  extracted  from  Q'  cannot  be  smaller  than  P1®P2-  The 
proof  for  Q"  is  similar.  Q.E.D, 

Proof  of  Theorem  6:  Lemmas  7,  8,  9  and  10  reduce  the  4-table  algorithm 
to  the  2-table  algorithm  whose  correctness  was  proved  in  Theorem  3. 
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i  4.  Time/Space  Tradeoffs 

£ 

I 

Lenina  1 1 :  If  a  set  of  problems  has  a  monotonic  composition  operator,  then 
for  any  P  and  P’  there  is  at  most  one  P"  such  that  P»P'9P". 

Proof:  If  Pj'  <  P£  are  two  different  solutions,  we  get  P'^P^P'^PJJ  which 
contradicts  the  monotoniclty  of  9  (note  that  |Pj  |  *  |PJ||  ■  |Pj  -  |P'|). 

Q.E.D. 

Definition:  The  complementation  operator  e  Is  the  partial  binary  operator 
defined  by: 

P"  *  PeP'  Iff  P  *  P'«P"  . 

The  problem  P"  Is  the  complement  of  P'  with  respect  to  P. 

Example:  Given  two  knapsack  problems  P *  (b,a1 ,. . . ,ap)  and  P‘  *  (b‘ .a^ , . . . ,a^) , 
P9P'  is  defined  (as  (b-b1 ,ai+1 ,. • • *an))  iff  *  <  n  and  for  all  1  <  i  <  t,  a^  =  a! . 

Given  two  exact  satisfiability  problems  P  and  P',  P-P'  is  defined  iff 
they  have  the  same  CNF  formula,  the  list  of  variables  in  P*  is  a  prefix 
of  the  list  of  variables  In  P,  and  the  componentwise  difference  between 
their  multiplicity  vectors  is  non-negative.  CJ 

In  all  examples  of  monotonic  9  operators  considered  so  far,  the  9 
operator  Is  easy  to  compute  in  polynomial  time  (either  directly  or  by  a 
quick  binary  search  on  candidate  problems). 

Theorem  12:  Let  Q  be  a  polynomial ly  enumerable  set  of  problems  with  a  mono¬ 
tonic  composition  operator  and  a  polynomial  complementation  operator,  and 
let  A  be  an  algorithm  that  solves  these  problems  In  0(2an)  time  and  0(2en) 


space  (for  some  0<a,8<  1).  Then  the  problems  in  Q  can  be  solved  in  any 
time/space  combination  along  the  tradeoff  curve  T*S^“a^  =  0(2n), 

0(2an)  <  t<  0(2n). 

Proof:  For  each  0<y<J,  let  A.  be  the  following  algorithm: 

J 

(1)  Enumerate  all  the  bit  strings  x'  of  size  (1  -y)»n. 

(2)  For  each  x'  enumerate  all  the  problems  P*  which  are  solved  by  x'. 

(3)  For  each  P',  find  its  complement  P"  with  respect  to  P;  if  it  exists, 
use  algorithm  A  to  solve  it;  if  it  is  solvable,  concatenate  x'  with 
its  solution  x",  print  it  out  and  halt. 

Note  that  for  y=0,  Aq  reduces  to  a  simple  exhaustive  search,  while 
for  y=  1,  A-j  reduces  to  A.  A  slight  technical  difficulty  is  that  for  each 
n  the  set  of  usable  values  of  y  is  discrete.  However,  for  large  values  of 
n  this  set  becomes  essentially  continuous. 

The  correctness  of  each  A^  follows  from  the  soundness  and  completeness 
of  ®  in  the  usual  way.  The  only  new  element  is  the  unbalanced  decomposition 
of  P  into  problems  of  sizes  (1  -y}»n  and  yn,  but  our  definition  of  complete¬ 
ness  is  general  enough  to  handle  this  case. 

Algorithm  A  is  applied  at  step  3  to  a  problem  of  size  yn  and  thus 
its  time  complexity  is  0(2°^°)  and  its  space  complexity  is  0(2^Yn).  Step  2 
multiplies  the  time  complexity  by  a  polynomial  factor,  and  step  1  multiplies 
it  further  by  0(2^’Y^n).  The  overall  time  complexity  of  is  thus 
T^  -  0(2^aY~Y+1 ^n)  and  its  space  complexity  is  =  0(2BYn). 

To  find  the  invariant  relation  satisfied  by  the  time/space  complexities 
of  all  the  A^  algorithms,  we  use  linear  algebra  in  order  to  eliminate  y: 
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T.sO-a)/e  =  o(2^aY”Y+1)n)*O(2eYn^‘a)/0) 

=  0(2^aY‘Y+1^n»2^Y-Ya)n) 

■  0{2n)  .  Q.E.D. 

Theorem  13:  If  a  polynomial ly  enumerable  set  of  problems  has  a  monotonic 
composition  operator  and  a  polynomial  complementation  operator,  then  Its 
Instances  of  size  n  can  be  solved  In  any  time/space  combination  along  the 
tradeoff  curve  T-S2  =  0(2n),  0(2n/2)  <  T <  0(2n) . 

Proof:  By  Theorem  6,  there  exists  an  algorithm  A  with  time  complexity  T  = 
0(2n^2)  and  space  complexity  S  =  0(2n/^4) .  By  substituting  a*  1/2  and  8  =  1/4 
into  the  general  formula,  we  get  the  tradeoff  curve  T*S2*0(2n).  Q.E.D. 

While  we  conjecture  that  T  =  0(2n/^2)  is  optimal  for  all  the  k-table 
problems,  we  do  not  have  any  reason  to  believe  that  S  =  0(2n^4)  is  optimal. 

If  S  can  be  reduced  to  S  =  0(2n^6)  or  S  =  0( 2n^® )  without  worsening  T,  we  can 
get  even  better  tradeoff  curves  such  as  T»S^  =  0(2n)  or  T*S^  =  0(2n). 

5.  Open  Problems  for  Further  Research 

(1)  Are  there  other  axiomatical ly  characterizable  subsets  of  NP-complete 
problems  which  can  be  solved  in  less  than  0(2n)  time? 

(ii)  Can  we  use  other  properties  of  0  (besides  monotonicity)  in  order  to 
reduce  the  complexity  of  the  k-table  problem? 

(Ill)  What  are  the  best  search  strategies  for  k>4  tables? 

(1v)  Is  T»0(2n^2)  a  lower  bound  for  all  k? 

(v)  Is  there  an  algorithm  with  T  =  0(2n^2)  but  S*  o(2n^4)? 
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(vl)  Are  there  easy  ways  to  determine  whether  a  set  of  problems  has  a 
monotonic  composition  operator? 

Acknowledgements:  We  would  like  to  thank  Martin  Heilman  and  Ron  Rivest 
for  many  fruitful  discussions. 
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